For commercial applications, a client computing platform typically operates in an environment where its behaviour is vulnerable to modification by local or remote entities. This potential insecurity of the platform is a limitation on its use by local parties who might otherwise be willing to use the platform, or remote parties who might otherwise communicate with the platform; for example, for the purposes of E-commerce. For the present purposes, both local parties and remote parties will be referred to as “users” unless otherwise stated.
Existing security applications, for example virus detection software, execute on computing platforms under the assumption that the platform will operate as intended and that the platform will not subvert processes and applications. This is a valid assumption provided that the intended software state has not become unstable or has not been damaged by other software such as viruses. Users, therefore, typically restrict the use of such platforms to non-critical applications, and weigh the convenience of using the platforms against the risk to sensitive or business critical data.
Increasing the level of trust in platforms therefore enables greater user confidence in existing security applications (such as the ‘Secure Sockets Layer’ or ‘IPSec’) or remote management applications. This enables greater reliance on those applications and hence reduced ‘cost of ownership’. Greater trust also enables new electronic methods of business, since there is greater confidence in the correct operation of both local and remote computing platforms.
In this document, the word ‘trust’ is used in the sense that something can be ‘trusted’ if it always behaves in the expected manner for the intended purpose.